We collect: (a) Account identifiers — name, email address, and mobile phone number provided during registration; (b) Authentication data — OTP verification records via Firebase Authentication; (c) Trade profile information — contact phone, location, and listing details you voluntarily publish on the TradeBoard; (d) Device data — device token for push notifications, platform (iOS/Android/Web), and app version; (e) Usage events — screens viewed, features accessed, and interaction timestamps via PostHog analytics; (f) Subscription and billing metadata — plan type, status, and expiry date (we do not store card numbers or payment instrument details); (g) Preferences — zone, commodity preference, font size, and notification settings. We collect only what is necessary to operate and improve the platform.

Your data is used for: (a) creating and managing your account; (b) authenticating your identity via phone OTP; (c) delivering market prices, reports, and personalised content based on your commodity and zone preferences; (d) processing and managing your subscription; (e) sending push notifications for market alerts, trade interests, and account updates — only with your consent; (f) facilitating TradeBoard connections between buyers and sellers; (g) improving platform reliability, fixing bugs, and developing new features through anonymised analytics. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

We engage the following sub-processors who handle personal data only as directed by us and under strict confidentiality obligations: (a) Firebase (Google LLC) — phone OTP authentication; (b) Supabase Inc. — database hosting and backend services; (c) PostHog Inc. — product analytics (anonymised); (d) Expo (Expo Technology Inc.) — push notification delivery; (e) Razorpay Software Pvt. Ltd. — payment processing for web subscriptions; (f) Apple Inc. / Google LLC — in-app purchase processing on iOS and Android respectively. We do not sell, rent, or trade your personal data to any third party.

The TradeBoard is a peer-to-peer marketplace. When you post a listing, your listed contact details (phone or WhatsApp number as entered in your trade profile) may be disclosed to another registered user who expresses a verified interest in your listing. You have full control over what contact information you include in your trade profile. Do not include information you are not comfortable sharing with other registered users. Coffee Bazaar does not disclose your account phone number beyond what you explicitly publish in your trade profile.

Web payments are processed by Razorpay Software Pvt. Ltd., a PCI-DSS compliant payment gateway. iOS and Android in-app purchases are processed entirely by Apple Inc. and Google LLC respectively through their native billing systems. Coffee Bazaar does not receive, store, or have access to your full card number, CVV, UPI credentials, or net banking details. We only receive payment confirmation, transaction ID, subscription tier, and amount metadata from these processors.

We implement industry-standard security measures including: (a) HTTPS/TLS encryption for all data in transit; (b) row-level security policies on our database; (c) token-based authentication with automatic session expiry; (d) access controls restricting employee access to personal data on a need-to-know basis. However, no method of electronic transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the relevant authority as required under applicable law.

We retain your account data for as long as your account remains active or as needed to provide services. TradeBoard listings expire automatically after 60 days. If you delete your account, we apply a 30-day soft-delete grace period during which you may reactivate. After 30 days, all personal data associated with your account is permanently and irreversibly purged from our systems. To request account deletion, use the Delete Account option in the app or email contact@coffeebazaar.in. Requests are processed within 30 days as required by applicable law.

We send push notifications only with your explicit permission. Notification types include: market price alerts, new TradeBoard interest on your listings, subscription updates, and important account notices. You can withdraw consent and disable notifications at any time from your device settings or the Account section in the app. Withdrawing consent does not affect data already processed under prior consent.

Subject to the Digital Personal Data Protection Act 2023 (India) and other applicable laws, you have the right to: (a) access the personal data we hold about you; (b) correct inaccurate or incomplete data; (c) request erasure of your data; (d) withdraw consent for processing at any time; (e) nominate a representative to exercise these rights on your behalf. To exercise any of these rights, email contact@coffeebazaar.in. We will respond within 30 days.

We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or platform features. Material changes will be notified via in-app notice or email before they take effect. Continued use of Coffee Bazaar after the effective date of any change constitutes acceptance of the revised policy. The 'Last Updated' date at the top of this page reflects the most recent revision.